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The World Employment Confederation Europe is the European body representing private employment 
services, including agency work, direct recruitment and career management. 


WEC- Europe welcomes the update of these guidelines and highlights the importance of shaping clarity and 
transparency on this topic. To this end, WEC- Europe in 2018 published its own guidelines for the sector on 
the concept of controller and processor to support its members with advice that tailors to the specifics of our 
members’ industry, services and day-to- day work. A copy of this document can be found via this link. 


We are glad to see that the draft EDPB Guidelines 07/2020 do not contradict the analysis and guidance we 
provide in our sectoral guidance document. As such, we believe the guidance should not be altered on 
fundamental points. 


We do believe there is room for further clarity and improvement on the following elements: 


1. Temporary Agency Work: the Triangular Employment Relationship 


1.1. Article 3 of Directive 2004/108/EC on temporary agency work describes a temporary work agency as “/.../any 
natural or legal person who, in compliance with national law, concludes contracts of employment or 
employment relationships with temporary agency workers in order to assign them to user undertakings to 
work there temporarily under their supervision and direction;/.../" 
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12. WEC- Europe members notice that this recognition of the employment relationship between the agency and 
the agency worker, is often not adequately or correctly understood in the context of the processing of 
personal data. This leads to a deterioration of protection of personal data as well as labour market rights and 
obligations as GDPR roles are sometimes inappropriately allocated between the Temporary Work Agency 
(TWA) and the user- undertaking. This is to the detriment of agency- workers’ personal data as it incorrectly 
assumes responsibility and accountability to parties that do not determine the purpose and means, and have 
no operational control, involvement or access to personal data that is legally processed in this employment 
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relationship. It is for that we reason we strongly recommend these guidelines include a specific example on 
agency work to support workers and business on the ground. 


Indeed, as the draft guidelines already extensively cover, a complex of obligations for processing personal data 
rests upon employers. These are put in place for good reasons: the protection of workers’ rights, efficient 
labour market administration, labour market transparency, compliance and a level playing field, and the 
collection of taxes and social protection contributions amongst many others. These obligations are 
indiscriminately in place for temporary work agencies as well. 


Moreover, TWAs determine to process personal data not just for the purpose of one agency work assignment 
to a specific user- undertaking alone. J obseekers expressly reach out to TWAs for gaining work experience and 
income from several different jobs; successive or overlapping (for instance, students often work at several 
different hospitality clients in one week. In the same way, IT specialist are often assigned to several companies 
over the course of their engagement with an employment agency). In fact, not seldomly legal obligations exist 
to track these successive consecutive assignments to determine (a built up of) workers’ and social protection 
rights. Indeed, it is the TWAs ambition to secure as much work at through temporary assignments at one or 
various user- undertakings as possible. 


Thus, a structural and deep relationship exists between the agency and the agency worker beyond one single 
job interview, assignment and/or user company alone. As such, it is in the driving seat to unilaterally determine 
the purposes and means of processing. 


Although there could be situation a TWA and a user- company process the same information (for instance on 
performance, training, working hours or migration status) they do not jointly determine the purposes and 
means of this processing. First, authorities often require - not necessarily overlapping - obligations for both of 
them to keep certain pieces of personal data. Secondly should both the TWA and the user- undertaking track 
performance and/or other HR related data this is done separately from each other for their respective 
purposes: the user- company will track performance to determine the continuation of an assignment or 
potentially to directly recruit an assigned agency worker, while the TWA will process this to enhance the 
profile of the worker for future assignments and other jobseeking and career support. As such, as a rule of 
thumb and irrespective of there being a mutual benefit to the partnership, the TWA and its client do not jointly 
determine the purposes and means of the processing. 


As such, to the extent a user- undertaking receives personal data from a TWA, it needs to be seen as third party 
recipient of the data that must be considered a controller for the processing that it carries out for its own 
purpose(s) after it receives the personal data. 


From this it strikes odd that confusion exists on the recognition of the agency as sole controller. Some private 
and public organisations deem the agency to be a processor on behalf of the user- company. This is an 
inherent flawed reasoning, contrary to these draft Guidelines as well as Guidance from the Article 29 Working 
Party they seek to update. These updated Guidelines on the various GDPR roles are an opportunity to create 
clarity on this by explicitly addressing the agency work employment relationship. 


In the space of the labour market, The Draft Guidelines already address recruitment (‘headhunters’) and payroll 
services. Agency work services are distinctly different from both a legal and market perspective. Providing 
further clarity on this would improve the Guidelines. 


Not doing so would persist this unclarity to the detriment of the protection of personal data, and data subjects’ 
rights as well as labour market protection, oversight and policymaking. It creates the situation that authorities 
and data subjects will not be able to recover information from the agency and will need to address a party that 
holds no legal ground for keeping all the relevant (sometimes sensitive) information on the agency workers 
who temporarily work under their supervision. Workers, businesses as well as labour market and data 
protection authorities need transparency on the allocation of roles and responsibilities in the triangular 
employment relationship. 
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As such we propose to include the following example in the Final version of the Guidelines. In light of the 
description in the Guidelines this should be added to section 3.2.3. ‘situations where there is no joint 
controllership’:: . 


Example: Temporary Agency Work 


Sharon is a gardener. She is employed by Temporary Work Agency X and is on an assignment at Client Y. 
Client Y is responsible for the operational supervision and direction of Sharon. As employer, Temporary 
Work Agency X is legally obliged to process data of Sharon and all the other agency workers it employs for 
example for payroll purpose. At the same time also Client Y has legal obligations to process personal data 
on Sharon for example on whether she is allowed to work in the country and the amount of hours Sharon 
works to ultimately check the invoice from Temporary Work Agency X. Both Temporary Work Agency X 
and Client Y have respective responsibilities with regards to their compliance of legal requirements. They 
each have to implement measures to meet these requirements. As such, Temporary Work Agency X is not 
the processor of Client Y with regards to these purposes, or the other way around. 


During the assignment, Client Y provides an occupational health & safety course for all it gardeners to 


improve the safety of their work. To track participation, Client Y registers all gardeners who have taken the 
course. Sharon completes the course and Client Y registers her completion in the overview. In this Client Y 
acts as a sole controller of this data processing. Temporary Work Agency X is not involved in the 
determination of the purpose or means. 


During the assignment Sharon is directed by Client Y to register customers’ gardening requests and 
preferences into a database for Client Y to improve its service delivery. In doing so Sharon has access to 
personal data of the customers of Client Y. Even though Sharon is employed by Temporary Work Agency 
X, she works under the supervision and direction of Client Y. Hence, she’s under the direct authority of the 
controller and is authorised to process personal data. Client Y remains controller and Temporary Work 
Agency X does not become controller or processor of this data, nor does Sharon. 





1.11 in this context we would also advise to add the wording “or alternatively” could be added to pt. 70 after 
‘sucessively for further clarification that various actors do not just process data successively: 


“[...] where various actors successively (ADD or alternatively) process the same personal data in a chain of 
operations, each of these actors [...]’. 


2. Persons authorised to process data 


2.1. WEC- Europe aligns with the analysis under pt. 86 that ‘interim staff provided via a temporary employment 
agency indeed are under the direct authority of the controller (i.e. user- undertaking under which supervision 
and direction the agency worker works). This indeed would align with the wording of Directive 2004/108/EC 
on temporary agency work. 


2.2. For the sake of clarity, we would suggest specifying the wording to explicitly include the agency worker: 


Pt/ 86 “I...Jas they are authorized to process personal data. An employee, {ADD: an agency worker}, etc. who 
obtains /.../” 


2.3. It is in this context we also welcome the guidance in pt. 76. Also here we believe the addition of ‘or agency 
worker would further clarify to clearly differentiate the triangular employment relation from the bilateral 
employment relation: 


Pt. 76: “[...) the direct authority of the controller, such as temporarily employed staff {ADD: and/or agency 
workers}, are not to be seen as processors{...]” 
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3. Technical cooperation 


We understand we bring forward a specific and technical dimension where labour market regulation and the 
protection of personal data intersect. WEC- Europe is more than happy to facilitate a further discussion to flesh 
out the specific legal and operational technicalities related to the protection of personal data in the context of 
temporary agency work, or other elements of this input. 


Should you wish further information, please contact J ochem de Boer at the WEC- Europe Head Office via 


jochem.deboer@wecglobal.org. 
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